- New-vocabulary titles. Guide and case-study titles come from guides.json, not production: "Introduction to Continuity" replaces "Introduction to Continuity Escrow", and case-study titles lose "100% Operations", "$12M" and "Eliminated". The downloads themselves still use the old names and the Validated, Verified and Certified levels: update them before launch. Fact-check, 7 Oct: the "Introduction to Continuity" blurb (copied from guides.json) said the service "stays switched on", with no "agreed period"; here it now uses the agreed Continuity wording. guides.json still has the old blurb and needs the same change by its owner.
- Left out: the "Software Resilience Solutions" e-book (production's comparison of "four escrow solutions" and Backup, superseded by the Product Overview guide); the "Verification check" tool (the obsolete Validated/Verified/Certified questionnaire, replaced by the product picker); the topic drop-down; the newsletter sign-up (no kit component; add production's HubSpot form back if wanted).
- Production copy dropped: "keep you compliant", "eliminate your software risk today", "unbeatable prices", "best price guaranteed" and "Let's build bulletproof software resilience together".
Guides, case studies and samples. Free to download.
What we've learned about software escrow, recovery and the regulations behind them, with briefings for each team and free tools that show where you stand.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Securing software since 2014
Start here
New to escrow? Read these first.
What escrow is, how to get started and what goes into the agreement.
Introduction to Software Escrow
What software escrow is, what it protects you from, and how automatic deposits keep it current.
Getting Started With Software Escrow
Practical first steps: find your critical vendors, set up deposits and build the evidence your auditor will ask for.
Expert Insights: Software Escrow Agreements
The terms in an escrow agreement, what goes into a deposit and how release events work.
- Links: downloads (guides, case studies, samples) go to production's /resources, where the forms are, and say "Download on codekeeper.co". Briefings and tools go to their kit pages. Video cards go to the rebuilt "What is software escrow?" film page, to production's video pages, or to the video hub.
- Samples: production has covers only for the sample agreement; the five use-case samples get an icon until covers exist.
- Only the clearer films are here. The video hub carries all of them, with the ones made for the previous line-up marked as such.
- Case studies are anonymised on production ("a healthcare network", "a logistics provider"). Check each still matches its facts before relaunching them under new titles.
The library
Everything, in one place.
Filter by type. Downloads are free with a work email.
Introduction to Software Escrow
What software escrow is, what it protects you from, and how automatic deposits keep it current.
Introduction to SaaS Escrow
How to protect a hosted application you don't run yourself: what to deposit, and how it comes back.
Introduction to AI Escrow
Which parts of an AI system need protecting, from models and deployments to prompts and workflows.
Introduction to Continuity
How a hosted service is kept paid and switched on for an agreed period when the vendor stops, while the recovery runs.
Getting Started With Software Escrow
Practical first steps: find your critical vendors, set up deposits and build the evidence your auditor will ask for.
Deposit Setup Overview
How deposits reach the vault, through integrations or secure upload, and what to deposit for each type of application.
Expert Insights: Software Escrow Agreements
The terms in an escrow agreement, what goes into a deposit and how release events work.
The Software Verification Handbook
How verification turns a deposit into proof that it builds and that you could exit.
Product Overview guide
The whole line-up on a few pages: what each protection does and what it costs.
Information Security Guide
How Codekeeper protects your deposits: data centre controls, encryption key management and incident response.
The DORA Guide
What DORA asks of ICT third-party risk, with a closer look at the exit plans Article 28 asks for.
The NIS2 Resilience Guide
The NIS2 requirements that touch your software suppliers, and where escrow evidence fits.
The CRA: Your Complete Compliance Guide
How to prepare for the Cyber Resilience Act: source code, components, SBOMs and the support period.
ISO 27001: Your Complete Information Security Compliance Guide
Annex A controls for supplier risk, backup and continuity, and the evidence that supports them.
ISO 22301 Compliance & Continuity Guide
Building a business continuity management system that covers supplier and system disruption.
SOC 2: Your Complete Trust and Data Protection Compliance Guide
The Security and Availability criteria, vendor risk and continuity, and evidence for a Type II review.
FFIEC Compliance: Your Complete Guide to Software Resilience
Third-party risk management and business continuity planning under the FFIEC handbooks.
APRA's CPS 230: Your Complete Operational Resilience Guide
The CPS 230 requirements for material service providers, and a roadmap for putting escrow evidence in place.
The EU AI Act: Your Complete Compliance Guide
How the AI Act treats AI as a regulated product, and how to keep documentation, logs and model configurations available.
Operational Excellence: A Guide to Stronger, More Resilient Operations
What operational excellence looks like in practice, and where software resilience fits.
What the Jaguar Land Rover Incident Reveals About Vendor Dependency Risk
What one cyber incident shows about the risk every software-dependent organisation carries.
How a Healthcare Network Protected Critical Systems From Vendor Risk
How a healthcare network kept control when its patient management vendor faced collapse.
Logistics Provider Keeps Operating When Its Software Vendor Disappears
The difference between having a contingency plan and having proven recovery, in one logistics company's story.
How an E-commerce Platform Kept Payments Running Through a Vendor Bankruptcy
How keeping a hosted service paid and switched on protected payment processing when a provider failed.
Gaming Studio Protects Its Investment When Its Development Platform Is Acquired
How a game developer kept its production schedule when its platform was acquired mid-development.
How SaaS Escrow Unlocked Enterprise Deals for a Growing Payment Platform
How proving continuity protection shortened sales cycles for a growing vendor selling to enterprises.
Sample Software Escrow Agreement
An annotated agreement that explains deposit materials, verification and release, clause by clause.
Software licensing sample
For licensing on-premise or cloud-based software from a third party.
Software development outsourcing sample
For projects that involve freelancers, development agencies or offshore teams.
Security and operational resilience sample
For building escrow into your business continuity or risk management plan.
Compliance and regulations sample
For when escrow is part of your evidence for frameworks such as the CRA, ISO 27001 or SOC 2.
Transactions, M&A, investment and financing sample
For deals where software or IP plays a central part in the transaction.
Decision makers
Lead the setup from the first call to the first deposit, with who does what and when to bring each team in.
Compliance officers
Send your due diligence requirements and get the security documentation and certification your review needs.
Procurement and finance
Register Codekeeper as a vendor, settle billing details and confirm PO requirements with one form.
Project managers
Activate the account, invite your team and configure the settings, step by step.
Legal advisors
Choose the template, define the release conditions and manage approval and signature with our legal team.
Tech teams
Organise the software assets, choose a deposit method and upload what the agreement requires.
What is software escrow?
How escrow protects you when software you depend on becomes unavailable, from agreement to release.
What is a software escrow agreement?
The parties, the deposit and the release conditions an agreement sets out.
How to deposit your assets
Connect an integration, pick your repositories and activate the deposit. Filmed in the previous design of the app.
All video guides
Short films on escrow, agreements, deposits and setup, plus the October launch films.
Risk assessment
Answer a few questions and get a report on where your software stack may be exposed, with next steps.
Compliance scan
A short scan of which cyber resilience regulations may apply to your organisation, and what they ask for.
Technical assessment
Work out which assets in your software stack need protecting.
Disaster Recovery Planner
Map your digital assets, see where you're exposed and plan your response before something goes wrong.
Find your protection
Two questions that point you to Escrow, Resilience or Continuity.
Keep reading
More from Codekeeper.
Analysis, news and the practical pages behind the guides.
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Questions
About the resources.
How do we download a guide or case study?
Enter your work email once, and every guide, case study and sample in the library is free to download.
Where should we start?
With Getting Started With Software Escrow, then Expert Insights: Software Escrow Agreements. After that, read the briefing for your role: decision makers, compliance, procurement, project managers, legal or tech.
How do we know which protection we need?
Start with what should happen if the application fails: released to you (Escrow), recovered by us (Resilience) or kept online while we recover (Continuity). Two questions point you to the right one.
What happened to the verification tiers?
Agentic Verification replaces Validated, Verified and Certified. It's included in Escrow Pro, Resilience Pro and Continuity Pro. Some downloads still describe the earlier levels while we update them. How Agentic Verification works
A download isn't working. What now?
Email contact@codekeeper.co or use the contact page, and we'll send it to you.
Read up, then see it on your applications.
Book a demo and we'll apply what's in the guides to the software you rely on. Not ready to talk? Start with the sample evidence pack.